The locations of those versions vary, depending on the type of forwarder and other factors. The forwarder automatically creates or edits custom versions of nf in response to the first three methods.
#Splunk conf files windows#
While installing the forwarder (on the Windows universal forwarder only.).There are several ways you can specify forwarding behavior: When you configure forwarding behavior, those changes get saved in custom versions of nf. The default version in the SplunkUniversalForwarder app has precedence over the version under /etc/system/default.ĭo not edit default versions of any configuration files. Another in $SPLUNK_HOME/etc/apps/SplunkUniversalForwarder/default.One in $SPLUNK_HOME/etc/system/default.The universal forwarder ships with these default versions of nf: The forwarder contains both default and custom nf files. No matter how many nf files the forwarder has and where they reside, the forwarder combines all their settings, using the rules of configuration file precedence. For example, one can be located in an apps directory and another in $SPLUNK_HOME/etc/system/local. Restart the universal forwarder to complete your changes.Ī single forwarder can have multiple nf files.Add a minimum of at least one forwarding target group or a single receiving host. Open nf for editing with a text editor.Go to the configuration directory for the forwarder.On the host that forwards that data that you want to collect, open a shell or command prompt or PowerShell window.For an example of what an nf file looks like, see "Examples of nf" later in this topic. You might have to edit the file in other places, as sections in this topic explain. This procedure details the steps you must take to edit the default nf which is in $SPLUNK_HOME/etc/system/local. See Add data and configure inputs in Getting Data In.Įdit nf to configure forwarding To specify the data that you want to collect from the forwarder, you must separately configure the inputs, as you would for any Splunk instance. The topics that describe various forwarding topologies, such as load balancing and intermediate forwarding, provide detailed examples on configuring nf to support those topologies.Īlthough nf is a required file for configuring forwarders, it addresses only the outputs from the forwarder, where you want the forwarder to send the data it collects. You can specify some output configurations at installation time (Windows universal forwarders only) or the CLI, but most advanced configuration settings require that you edit nf. The nf file defines how forwarders send data to receivers.
0 kommentar(er)
